What this kind of message looks like
Someone in finance, administration or an assistant role receives a short email that appears to come from the company’s owner or a senior manager. It asks for something unusual: a payment to a new account, a batch of gift cards, a change to bank details, or a quick favor “before the meeting.” It often says the sender is busy, cannot take calls, and wants it handled discreetly.
This pattern is sometimes called business email compromise or executive impersonation. The message may come from a look-alike address, from a free email account using the executive’s name, or, less commonly, from a genuinely hijacked mailbox. In every version the goal is the same: to get a trusting employee to move money or share information before anyone double-checks.
Why it works on sensible people
These messages do not rely on technical tricks. They rely on ordinary workplace dynamics.
- Authority. Most people do not want to question the boss.
- Urgency. A deadline discourages the pause that would expose the problem.
- Secrecy. “Keep this between us” removes the colleagues who might notice something wrong.
- Plausibility. Scammers often reference real names, projects or travel plans that are easy to find in public profiles, which makes the request feel informed. It is worth thinking about how much your digital footprint reveals about who works where and who approves payments.
Falling for it says nothing about intelligence. It says the process lacked a check.
Warning signs worth noticing
No single sign proves a message is fake, but several together are a strong reason to stop:
- A request that bypasses the usual approval steps.
- Payment to a new or personal account, or in an unusual form such as gift cards or cryptocurrency.
- Pressure to act before a meeting, flight or end of day.
- A claim that the sender cannot be reached by phone.
- A sender address that is slightly off, or a reply-to address that differs from the sender.
- Wording or tone that does not match how the person normally writes.
Voice and video are no longer a guaranteed fix either, since the technology behind voice cloning scams and deepfake videos has improved. That is one reason the verification step below should use a contact method you already trust rather than one supplied in the message.
The one habit that matters most
Confirm unusual requests through a different channel before acting. If the email claims to be from your director, call the director on a number you already have, or speak to them in person, or send a message through your company’s separate internal system. Do not reply to the email, and do not use a phone number given in the email. The point is that a person who controls only the email thread cannot also control the second channel.
This applies even when the request seems minor and even when the sender seems annoyed. A real executive will generally accept a thirty-second confirmation. If they will not, a policy that backs you up is better than your own judgment under pressure.
Build verification into the process
It is easier to follow a rule than to improvise. Organizations of any size can agree on a few simple practices, in line with general small business cybersecurity advice:
- Two people for payments. Require a second approver for new payees, changed bank details and payments above an agreed amount.
- Call-back rule. Any change to payment instructions must be confirmed by calling a known number on file.
- No gift cards. State plainly that the company never asks staff to buy gift cards by email.
- Permission to pause. Make it explicitly acceptable to question a request from anyone, including leadership.
- Clear reporting. Tell staff who to notify about a suspicious message, and thank people who report even false alarms.
A related pattern is invoice fraud, where a fake supplier bill or altered bank details arrive from someone pretending to be a vendor. The same call-back rule helps.
Reduce what scammers can learn
Impersonators often draw on public details. Consider limiting what is shared publicly about roles, approval authority and travel. Company websites and professional profiles do not need to show who signs off on payments or when the owner is away. Using two-step sign-in on executive and finance mailboxes also makes real account takeovers harder, though it is not a complete defense.
If you already sent money or information
Act quickly and calmly:
- Contact your bank or payment provider immediately and explain that a payment may have been fraudulent. Speed often improves the chance of intervention, though recovery is never guaranteed.
- Tell your manager or the person responsible for finance and IT.
- Keep the original email and any related details; do not delete them.
- Consider reporting the incident to your local police or the fraud reporting channel in your country.
- Review the affected mailboxes for signs of takeover and change relevant passwords.
If an employee made the mistake, handle it as a process failure first. People who fear blame tend to report late, and delay is expensive.
Telling the real thing from the fake
Real urgent requests exist. A genuine request from a manager survives a quick check without causing harm. A fraudulent one does not. That asymmetry is the whole defense: verification costs a few minutes when the request is real and prevents a large loss when it is not.
If you ever feel pushed to skip the check because the sender said not to, treat that instruction itself as the warning sign.